2021 CVEs (page 226)
Page 226 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-21456 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21455 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21454 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21453 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21452 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21451 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SGI file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21450 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PSD file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21449 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21448 | Medium | 6.5 | 2021-01-12 | SAP GUI for Windows, version - 7.60, allows an attacker to spoof logon credentials for Application Server ABAP backend systems in the client PCs memory. Under… |
CVE-2021-21447 | Medium | 5.4 | 2021-01-12 | SAP BusinessObjects Business Intelligence platform, versions 410, 420, allows an authenticated attacker to inject malicious JavaScript payload into the custom… |
CVE-2021-21446 | High | 7.5 | 2021-01-12 | SAP NetWeaver AS ABAP, versions 740, 750, 751, 752, 753, 754, 755, allows an unauthenticated attacker to prevent legitimate users from accessing a service, eit… |
CVE-2021-21445 | Medium | 5.4 | 2021-01-12 | SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content Type hea… |
CVE-2021-23240 | High | 7.8 | 2021-01-12 | selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a tempor… |
CVE-2021-23239 | Low | 2.5 | 2021-01-12 | The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race… |
CVE-2021-0322 | Medium | 5.0 | 2021-01-11 | In onCreate of SlicePermissionActivity.java, there is a possible misleading string displayed due to improper input validation. This could lead to local informa… |
CVE-2021-0321 | Medium | 5.5 | 2021-01-11 | In enforceDumpPermissionForPackage of ActivityManagerService.java, there is a possible way to determine if a package is installed due to side channel informati… |
CVE-2021-0320 | Medium | 4.7 | 2021-01-11 | In is_device_locked and set_device_locked of keystore_keymaster_enforcement.h, there is a possible bypass of lockscreen requirements for keyguard bound keys du… |
CVE-2021-0319 | High | 7.3 | 2021-01-11 | In checkCallerIsSystemOr of CompanionDeviceManagerService.java, there is a possible way to get a nearby Bluetooth device's MAC address without appropriate perm… |
CVE-2021-0318 | High | 7.8 | 2021-01-11 | In appendEventsToCacheLocked of SensorEventConnection.cpp, there is a possible out of bounds write due to a use-after-free. This could lead to local escalation… |
CVE-2021-0317 | High | 7.8 | 2021-01-11 | In createOrUpdate of Permission.java and related code, there is possible permission escalation due to a logic error. This could lead to local escalation of pri… |
CVE-2021-0316 | Critical | 9.8 | 2021-01-11 | In avrc_pars_vendor_cmd of avrc_pars_tg.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution ove… |
CVE-2021-0315 | High | 7.3 | 2021-01-11 | In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to convince the user to grant an app access to an account due to a tapjacking/o… |
CVE-2021-0313 | High | 7.5 | 2021-01-11 | In isWordBreakAfter of LayoutUtils.cpp, there is a possible way to slow or crash a TextView due to improper input validation. This could lead to remote denial… |
CVE-2021-0312 | Medium | 6.5 | 2021-01-11 | In WAVSource::read of WAVExtractor.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote information disclosure wi… |
CVE-2021-0311 | Medium | 6.5 | 2021-01-11 | In ElementaryStreamQueue::dequeueAccessUnitH264() of ESQueue.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to rem… |
CVE-2021-0310 | High | 7.8 | 2021-01-11 | In LazyServiceRegistrar of LazyServiceRegistrar.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of priv… |
CVE-2021-0309 | Medium | 5.5 | 2021-01-11 | In onCreate of grantCredentialsPermissionActivity, there is a confused deputy. This could lead to local information disclosure and account access with no addit… |
CVE-2021-0308 | Medium | 6.8 | 2021-01-11 | In ReadLogicalParts of basicmbr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege wit… |
CVE-2021-0307 | High | 7.8 | 2021-01-11 | In updatePermissionSourcePackage of PermissionManagerService.java, there is a possible automatic runtime permission grant due to a confused deputy. This could… |
CVE-2021-0306 | High | 7.8 | 2021-01-11 | In addAllPermissions of PermissionManagerService.java, there is a possible permissions bypass when upgrading major Android versions which allows an app to gain… |
CVE-2021-0304 | Medium | 5.5 | 2021-01-11 | In several functions of GlobalScreenshot.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information discl… |
CVE-2021-0303 | High | 7.0 | 2021-01-11 | In dispatchGraphTerminationMessage() of packages/services/Car/computepipe/runner/graph/StreamSetObserver.cpp, there is a possible use after free due to a race… |
CVE-2021-0301 | Medium | 6.7 | 2021-01-11 | In ged, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2021-21241 | High | 7.4 | 2021-01-11 | The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask… |
CVE-2021-0342 | Medium | 6.7 | 2021-01-11 | In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution p… |
CVE-2021-23253 | Medium | 5.3 | 2021-01-11 | Opera Mini for Android below 53.1 displays URL left-aligned in the address field. This allows a malicious attacker to craft a URL with a long domain name, e.g… |
CVE-2021-3121 | High | 8.6 | 2021-01-11 | An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue. |
CVE-2021-3118 | Critical | 9.8 | 2021-01-11 | EVOLUCARE ECSIMAGING (aka ECS Imaging) through 6.21.5 has multiple SQL Injection issues in the login form and the password-forgotten form (such as /req_passwor… |
CVE-2021-3116 | High | 7.5 | 2021-01-11 | before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean… |
CVE-2021-21116 | High | 8.8 | 2021-01-08 | Heap buffer overflow in audio in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21115 | Critical | 9.6 | 2021-01-08 | User after free in safe browsing in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perf… |
CVE-2021-21114 | High | 8.8 | 2021-01-08 | Use after free in audio in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21113 | High | 8.8 | 2021-01-08 | Heap buffer overflow in Skia in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21112 | High | 8.8 | 2021-01-08 | Use after free in Blink in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21111 | Critical | 9.6 | 2021-01-08 | Insufficient policy enforcement in WebUI in Google Chrome prior to 87.0.4280.141 allowed an attacker who convinced a user to install a malicious extension to p… |
CVE-2021-21110 | Critical | 9.6 | 2021-01-08 | Use after free in safe browsing in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML pa… |
CVE-2021-21109 | Critical | 9.6 | 2021-01-08 | Use after free in payments in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2021-21108 | Critical | 9.6 | 2021-01-08 | Use after free in media in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a san… |
CVE-2021-21107 | Critical | 9.6 | 2021-01-08 | Use after free in drag and drop in Google Chrome on Linux prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentia… |
CVE-2021-21106 | Critical | 9.6 | 2021-01-08 | Use after free in autofill in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2021-3111 | Medium | 4.8 | 2021-01-08 | The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI. |
CVE-2021-1066 | Medium | 5.5 | 2021-01-08 | NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which input data is not validated, which may lead to unexpected consumption of resources, w… |
CVE-2021-1065 | High | 7.1 | 2021-01-08 | NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which input data is not validated, which may lead to tampering of data or denial of service… |
CVE-2021-1064 | High | 7.1 | 2021-01-08 | NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which it obtains a value from an untrusted source, converts this value to a pointer, and de… |
CVE-2021-1063 | High | 7.8 | 2021-01-08 | NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input offset is not validated, which may lead to a buffer overread, which in turn… |
CVE-2021-1062 | High | 7.1 | 2021-01-08 | NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input data length is not validated, which may lead to tampering of data or denial… |
CVE-2021-1061 | Medium | 6.3 | 2021-01-08 | NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which a race condition may cause the vGPU plugin to continue using a previously validated r… |
CVE-2021-1060 | High | 7.1 | 2021-01-08 | NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and vGPU plugin, in which an input index is not validated, which may lead to tamp… |
CVE-2021-1059 | High | 7.8 | 2021-01-08 | NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input index is not validated, which may lead to integer overflow, which in turn ma… |
CVE-2021-1058 | High | 7.1 | 2021-01-08 | NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and vGPU plugin, in which an input data size is not validated, which may lead to… |
CVE-2021-1057 | High | 7.8 | 2021-01-08 | NVIDIA Virtual GPU Manager NVIDIA vGPU manager contains a vulnerability in the vGPU plugin in which it allows guests to allocate some resources for which the g… |
CVE-2021-3025 | High | 8.8 | 2021-01-08 | Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API (the sortDir parameter in a sortBy=popular action to the… |
CVE-2021-1056 | High | 7.1 | 2021-01-08 | NVIDIA GPU Display Driver for Linux, all versions, contains a vulnerability in the kernel mode layer (nvidia.ko) in which it does not completely honor operatin… |
CVE-2021-1055 | Medium | 5.3 | 2021-01-08 | NVIDIA GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which improp… |
CVE-2021-1054 | Medium | 5.5 | 2021-01-08 | NVIDIA GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which the so… |
CVE-2021-1053 | Medium | 5.5 | 2021-01-08 | NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape or IO… |
CVE-2021-1052 | High | 7.8 | 2021-01-08 | NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape or IO… |
CVE-2021-1051 | High | 8.4 | 2021-01-08 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which a local user can get… |
CVE-2021-23242 | Medium | 5.3 | 2021-01-07 | MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ to the UPnP server, as demonstrated by the /../../conf/template/uhttpd.json URI. |
CVE-2021-23241 | Medium | 5.3 | 2021-01-07 | MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI (for authentication bypass) to the web s… |
CVE-2021-3011 | Medium | 4.2 | 2021-01-07 | An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure authentication microcontrollers, with C… |
CVE-2021-3029 | Critical | 9.8 | 2021-01-07 | EVOLUCARE ECSIMAGING (aka ECS Imaging) through 6.21.5 has an OS Command Injection vulnerability via shell metacharacters and an IFS manipulation. The parameter… |
CVE-2021-21236 | Medium | 5.7 | 2021-01-06 | CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of ser… |
CVE-2021-21235 | Medium | 5.7 | 2021-01-06 | kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifical… |
CVE-2021-3026 | Medium | 6.1 | 2021-01-05 | Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment. |
CVE-2021-3022 | Medium | 5.5 | 2021-01-05 | An issue was discovered on LG mobile devices with Android OS 10 software. There was no write protection for the MTK protect2 partition. The LG ID is LVE-SMP-20… |
CVE-2021-22495 | Medium | 5.5 | 2021-01-05 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) (Exynos chipsets) software. The Mali GPU driver allows out-of-bound… |
CVE-2021-22494 | Medium | 5.5 | 2021-01-05 | An issue was discovered in the fingerprint scanner on Samsung Note20 mobile devices with Q(10.0) software. When a screen protector is used, the required image… |
CVE-2021-22492 | High | 8.8 | 2021-01-05 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Broadcom Bluetooth chipsets) software. The Bluetooth UART driver has a buff… |
CVE-2021-21234 | High | 7.7 | 2021-01-05 | spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package "eu.hinsch:spring-boot-actuat… |
CVE-2021-3021 | Critical | 9.8 | 2021-01-05 | ISPConfig before 3.2.2 allows SQL injection. |
CVE-2021-3019 | High | 7.5 | 2021-01-05 | ffay lanproxy 0.1 allows Directory Traversal to read /../conf/config.properties to obtain credentials for a connection to the intranet. |
CVE-2021-3018 | Critical | 9.8 | 2021-01-05 | ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerable to an unauthenticated Boolean-based SQL injection via the id parameter on the /cms/print.php page. |
CVE-2021-3014 | Medium | 6.1 | 2021-01-04 | In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter. |
CVE-2021-3007 | Critical | 9.8 | 2021-01-04 | Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content… |
CVE-2021-21495 | High | 8.8 | 2021-01-04 | MK-AUTH through 19.01 K4.9 allows CSRF for password changes via the central/executar_central.php?acao=altsenha_princ URI. |
CVE-2021-21494 | Medium | 4.8 | 2021-01-04 | MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo parameter. An attacker can leverage this to read the centralmka2 (session token) cookie… |
CVE-2021-3006 | High | 7.5 | 2021-01-03 | The breed function in the smart contract implementation for Farm in Seal Finance (Seal), an Ethereum token, lacks access control and thus allows price manipula… |
CVE-2021-3005 | Medium | 4.3 | 2021-01-03 | MK-AUTH through 19.01 K4.9 allows remote attackers to obtain sensitive information (e.g., a CPF number) via a modified titulo (aka invoice number) value to the… |
CVE-2021-3004 | High | 7.5 | 2021-01-03 | The _deposit function in the smart contract implementation for Stable Yield Credit (yCREDIT), an Ethereum token, has certain incorrect calculations. An attacke… |
CVE-2021-3002 | Medium | 6.1 | 2021-01-01 | Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter. |